From ffc0361525e8c2d119462995d1b552776cdb66d3 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Mon, 8 Mar 2021 15:37:33 -0600 Subject: [PATCH 1/2] add isMemberOf support --- Workbench/directory/Dockerfile | 3 +- .../seed-data/edumember-obj.ldif | 30 + .../resources/100-ldap-main.xml | 1056 +++++++++++++++++ .../roles/200-metarole-ldap-group.xml | 14 + 4 files changed, 1102 insertions(+), 1 deletion(-) create mode 100644 Workbench/directory/container_files/seed-data/edumember-obj.ldif diff --git a/Workbench/directory/Dockerfile b/Workbench/directory/Dockerfile index 3fc3b6e..85b4164 100644 --- a/Workbench/directory/Dockerfile +++ b/Workbench/directory/Dockerfile @@ -24,7 +24,8 @@ RUN useradd ldapadmin \ && /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-dir \ && while ! curl -s ldap://localhost:389 > /dev/null; do echo waiting for ldap to start; sleep 1; done; \ ldapadd -H ldap:/// -f /seed-data/data.ldif -x -D "cn=Directory Manager" -w password \ - && ldapmodify -H ldap:/// -f /seed-data/incwbperson-obj.ldif -x -D "cn=Directory Manager" -w password + && ldapmodify -H ldap:/// -f /seed-data/incwbperson-obj.ldif -x -D "cn=Directory Manager" -w password \ + && ldapmodify -H ldap:/// -f /seed-data/edumember-obj.ldif -x -D "cn=Directory Manager" -w password EXPOSE 389 443 diff --git a/Workbench/directory/container_files/seed-data/edumember-obj.ldif b/Workbench/directory/container_files/seed-data/edumember-obj.ldif new file mode 100644 index 0000000..38b287f --- /dev/null +++ b/Workbench/directory/container_files/seed-data/edumember-obj.ldif @@ -0,0 +1,30 @@ +# +# eduMember Objectclass +# +# +# "eduMember" attributes +# +dn: cn=schema +changetype: modify +# +add: attributetypes +attributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.1 + NAME 'isMemberOf' + DESC 'identifiers for groups to which containing entity belongs' + EQUALITY caseExactMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) +attributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.2 + NAME 'hasMember' + DESC 'identifiers for entities that are members of the group' + EQUALITY caseExactMatch + SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) +- +# +add: objectclasses +objectClasses: ( 1.3.6.1.4.1.5923.1.5.2 NAME 'eduMember' + AUXILIARY + MAY ( isMemberOf $ hasMember ) + ) +# +# end of LDIF +# diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml index f3a4892..0e7d770 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml @@ -61,6 +61,7 @@ ri:inetOrgPerson ri:eduPerson + ri:eduMember ri:incwbPerson ri:organizationalPerson ri:person @@ -68,6 +69,1050 @@ ri:groupOfNames ri:organizationalUnit + + + + + + + + + ri:nsUniqueId + ri:dn + ri:dn + ri:dn + eduMember + true + + + + + + + 120 + nsAccountLock + nsAccountLock + false + + + + + + + 130 + read + createTimestamp + createTimestamp + false + + + + + + + 140 + qn973:distinguishedName + memberOf + memberOf + false + + + + + + + 150 + hasMember + hasMember + + + + + + + 110 + qn468:distinguishedName + dn + __NAME__ + + + + + + + 160 + isMemberOf + isMemberOf + + + + + + + 100 + read + nsUniqueId + __UID__ + + + + + + + + + + ri:entryUUID + ri:dn + ri:dn + ri:dn + inetOrgPerson + + + + + + + 120 + qn277:stringIgnoreCase + initials + initials + + + + + + + 130 + memberOf + memberOf + false + + + + + + + 140 + homePhone + homePhone + + + + + + + 150 + audio + audio + + + + + + + 160 + qn612:stringIgnoreCase + mail + mail + + + + + + + 170 + qn779:stringIgnoreCase + carLicense + carLicense + + + + + + + 180 + qn508:stringIgnoreCase + departmentNumber + departmentNumber + + + + + + + 190 + qn578:distinguishedName + manager + manager + + + + + + + 200 + qn454:stringIgnoreCase + businessCategory + businessCategory + + + + + + + 210 + homePostalAddress + homePostalAddress + + + + + + + 220 + qn723:distinguishedName + secretary + secretary + + + + + + + 230 + photo + photo + + + + + + + 240 + labeledURI + labeledURI + + + + + + + 250 + qn735:stringIgnoreCase + displayName + displayName + + + + + + + 260 + pager + pager + + + + + + + 270 + qn74:stringIgnoreCase + roomNumber + roomNumber + + + + + + + 280 + qn272:stringIgnoreCase + physicalDeliveryOfficeName + physicalDeliveryOfficeName + + + + + + + 290 + qn301:stringIgnoreCase + uid + uid + + + + + + + 300 + qn348:distinguishedName + seeAlso + seeAlso + + + + + + + 310 + qn817:stringIgnoreCase + destinationIndicator + destinationIndicator + + + + + + + 320 + postalAddress + postalAddress + + + + + + + 330 + qn260:stringIgnoreCase + preferredLanguage + preferredLanguage + + + + + + + 340 + preferredDeliveryMethod + preferredDeliveryMethod + + + + + + + 350 + facsimileTelephoneNumber + facsimileTelephoneNumber + + + + + + + 360 + qn847:stringIgnoreCase + employeeType + employeeType + + + + + + + 370 + internationaliSDNNumber + internationaliSDNNumber + + + + + + + 380 + qn290:stringIgnoreCase + postOfficeBox + postOfficeBox + + + + + + + 390 + telephoneNumber + telephoneNumber + + + + + + + 400 + qn79:stringIgnoreCase + l + l + + + + + + + 410 + qn814:stringIgnoreCase + employeeNumber + employeeNumber + + + + + + + 420 + jpegPhoto + jpegPhoto + + + + + + + 430 + qn632:stringIgnoreCase + o + o + + + + + + + 440 + userPKCS12 + userPKCS12 + + + + + + + 450 + qn773:stringIgnoreCase + description + description + + + + + + + 110 + qn855:distinguishedName + dn + __NAME__ + + + + + + + 460 + qn824:stringIgnoreCase + sn + sn + + + + + + + 470 + qn72:stringIgnoreCase + givenName + givenName + + + + + + + 480 + telexNumber + telexNumber + + + + + + + 490 + qn503:stringIgnoreCase + postalCode + postalCode + + + + + + + 500 + read + createTimestamp + createTimestamp + false + + + + + + + 510 + userSMIMECertificate + userSMIMECertificate + + + + + + + 520 + userCertificate + userCertificate + + + + + + + 530 + qn417:stringIgnoreCase + st + st + + + + + + + 540 + teletexTerminalIdentifier + teletexTerminalIdentifier + + + + + + + 550 + qn682:stringIgnoreCase + ou + ou + + + + + + + 560 + qn114:stringIgnoreCase + street + street + + + + + + + 570 + qn260:stringIgnoreCase + cn + cn + + + + + + + 580 + registeredAddress + registeredAddress + + + + + + + 590 + x121Address + x121Address + + + + + + + 600 + qn103:stringIgnoreCase + title + title + + + + + + + 610 + x500UniqueIdentifier + x500UniqueIdentifier + + + + + + + 620 + mobile + mobile + + + + + + + 100 + read + qn946:uuid + entryUUID + __UID__ + + + + + + + + + + ri:entryUUID + ri:dn + ri:dn + ri:dn + groupOfUniqueNames + + + + + + + 120 + read + createTimestamp + createTimestamp + false + + + + + + + 130 + uniqueMember + uniqueMember + + + + + + + 140 + memberOf + memberOf + false + + + + + + + 150 + qn47:stringIgnoreCase + ou + ou + + + + + + + 160 + qn800:stringIgnoreCase + cn + cn + + + + + + + 170 + qn573:stringIgnoreCase + o + o + + + + + + + 180 + qn389:distinguishedName + owner + owner + + + + + + + 190 + qn748:distinguishedName + seeAlso + seeAlso + + + + + + + 200 + qn447:stringIgnoreCase + description + description + + + + + + + 210 + qn897:stringIgnoreCase + businessCategory + businessCategory + + + + + + + 110 + qn327:distinguishedName + dn + __NAME__ + + + + + + + 100 + read + qn35:uuid + entryUUID + __UID__ + + + + + + + + + + ri:entryUUID + ri:dn + ri:dn + ri:dn + eduPerson + true + + + + + + + 120 + read + createTimestamp + createTimestamp + false + + + + + + + 130 + qn158:stringIgnoreCase + eduPersonScopedAffiliation + eduPersonScopedAffiliation + + + + + + + 140 + memberOf + memberOf + false + + + + + + + 150 + qn631:stringIgnoreCase + eduPersonPrimaryAffiliation + eduPersonPrimaryAffiliation + + + + + + + 160 + qn676:distinguishedName + eduPersonOrgDN + eduPersonOrgDN + + + + + + + 170 + qn444:distinguishedName + eduPersonOrgUnitDN + eduPersonOrgUnitDN + + + + + + + 180 + qn549:stringIgnoreCase + eduPersonAffiliation + eduPersonAffiliation + + + + + + + 190 + qn371:stringIgnoreCase + eduPersonPrincipalNamePrior + eduPersonPrincipalNamePrior + + + + + + + 200 + qn469:stringIgnoreCase + eduPersonTargetedID + eduPersonTargetedID + + + + + + + 210 + eduPersonEntitlement + eduPersonEntitlement + + + + + + + 220 + qn27:stringIgnoreCase + eduPersonAssurance + eduPersonAssurance + + + + + + + 230 + qn972:stringIgnoreCase + eduPersonNickname + eduPersonNickname + + + + + + + 240 + qn626:stringIgnoreCase + eduPersonOrcid + eduPersonOrcid + + + + + + + 250 + qn606:stringIgnoreCase + eduPersonPrincipalName + eduPersonPrincipalName + + + + + + + 260 + qn835:distinguishedName + eduPersonPrimaryOrgUnitDN + eduPersonPrimaryOrgUnitDN + + + + + + + 110 + qn348:distinguishedName + dn + __NAME__ + + + + + + + 270 + qn319:stringIgnoreCase + eduPersonUniqueId + eduPersonUniqueId + + + + + + + 100 + read + qn942:uuid + entryUUID + __UID__ + + + + + + + + + + ri:nsUniqueId + ri:dn + ri:dn + ri:dn + incwbPerson + true + + + + + + + 120 + nsAccountLock + nsAccountLock + false + + + + + + + 130 + read + createTimestamp + createTimestamp + false + + + + + + + 140 + qn940:distinguishedName + memberOf + memberOf + false + + + + + + + 150 + qn491:stringIgnoreCase + incwbPersonEmployeeID + incwbPersonEmployeeID + + + + + + + 160 + qn200:stringIgnoreCase + incwbPersonStudentID + incwbPersonStudentID + + + + + + + 170 + qn405:stringIgnoreCase + incwbPersonGuestID + incwbPersonGuestID + + + + + + + 110 + qn965:distinguishedName + dn + __NAME__ + + + + + + + 100 + read + nsUniqueId + __UID__ + + + + + + + @@ -77,6 +1122,7 @@ true ri:inetOrgPerson ri:eduPerson + ri:eduMember ri:incwbPerson ri:dn @@ -249,6 +1295,15 @@ objectToSubject ri:uniqueMember ri:dn + + + ri:isMemberOfAssociation + false + entitlement + group + subjectToObject + ri:isMemberOf + ri:cn @@ -303,6 +1358,7 @@ ri:cn mr:stringIgnoreCase + true weak diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml index 91bf370..dc52597 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/roles/200-metarole-ldap-group.xml @@ -121,6 +121,20 @@ + + + ri:isMemberOfAssociation + + + + + entitlement + group + + 1 + + + 3 From 04e078b6970db8995d229e7a33e13102a26ad9f3 Mon Sep 17 00:00:00 2001 From: Paul Caskey Date: Mon, 8 Mar 2021 16:29:10 -0600 Subject: [PATCH 2/2] remove unneeded schema --- .../resources/100-ldap-main.xml | 1044 ----------------- 1 file changed, 1044 deletions(-) diff --git a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml index 0e7d770..0a84e3c 100644 --- a/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml +++ b/Workbench/midpoint_server/container_files/mp-home/post-initial-objects/resources/100-ldap-main.xml @@ -69,1050 +69,6 @@ ri:groupOfNames ri:organizationalUnit - - - - - - - - - ri:nsUniqueId - ri:dn - ri:dn - ri:dn - eduMember - true - - - - - - - 120 - nsAccountLock - nsAccountLock - false - - - - - - - 130 - read - createTimestamp - createTimestamp - false - - - - - - - 140 - qn973:distinguishedName - memberOf - memberOf - false - - - - - - - 150 - hasMember - hasMember - - - - - - - 110 - qn468:distinguishedName - dn - __NAME__ - - - - - - - 160 - isMemberOf - isMemberOf - - - - - - - 100 - read - nsUniqueId - __UID__ - - - - - - - - - - ri:entryUUID - ri:dn - ri:dn - ri:dn - inetOrgPerson - - - - - - - 120 - qn277:stringIgnoreCase - initials - initials - - - - - - - 130 - memberOf - memberOf - false - - - - - - - 140 - homePhone - homePhone - - - - - - - 150 - audio - audio - - - - - - - 160 - qn612:stringIgnoreCase - mail - mail - - - - - - - 170 - qn779:stringIgnoreCase - carLicense - carLicense - - - - - - - 180 - qn508:stringIgnoreCase - departmentNumber - departmentNumber - - - - - - - 190 - qn578:distinguishedName - manager - manager - - - - - - - 200 - qn454:stringIgnoreCase - businessCategory - businessCategory - - - - - - - 210 - homePostalAddress - homePostalAddress - - - - - - - 220 - qn723:distinguishedName - secretary - secretary - - - - - - - 230 - photo - photo - - - - - - - 240 - labeledURI - labeledURI - - - - - - - 250 - qn735:stringIgnoreCase - displayName - displayName - - - - - - - 260 - pager - pager - - - - - - - 270 - qn74:stringIgnoreCase - roomNumber - roomNumber - - - - - - - 280 - qn272:stringIgnoreCase - physicalDeliveryOfficeName - physicalDeliveryOfficeName - - - - - - - 290 - qn301:stringIgnoreCase - uid - uid - - - - - - - 300 - qn348:distinguishedName - seeAlso - seeAlso - - - - - - - 310 - qn817:stringIgnoreCase - destinationIndicator - destinationIndicator - - - - - - - 320 - postalAddress - postalAddress - - - - - - - 330 - qn260:stringIgnoreCase - preferredLanguage - preferredLanguage - - - - - - - 340 - preferredDeliveryMethod - preferredDeliveryMethod - - - - - - - 350 - facsimileTelephoneNumber - facsimileTelephoneNumber - - - - - - - 360 - qn847:stringIgnoreCase - employeeType - employeeType - - - - - - - 370 - internationaliSDNNumber - internationaliSDNNumber - - - - - - - 380 - qn290:stringIgnoreCase - postOfficeBox - postOfficeBox - - - - - - - 390 - telephoneNumber - telephoneNumber - - - - - - - 400 - qn79:stringIgnoreCase - l - l - - - - - - - 410 - qn814:stringIgnoreCase - employeeNumber - employeeNumber - - - - - - - 420 - jpegPhoto - jpegPhoto - - - - - - - 430 - qn632:stringIgnoreCase - o - o - - - - - - - 440 - userPKCS12 - userPKCS12 - - - - - - - 450 - qn773:stringIgnoreCase - description - description - - - - - - - 110 - qn855:distinguishedName - dn - __NAME__ - - - - - - - 460 - qn824:stringIgnoreCase - sn - sn - - - - - - - 470 - qn72:stringIgnoreCase - givenName - givenName - - - - - - - 480 - telexNumber - telexNumber - - - - - - - 490 - qn503:stringIgnoreCase - postalCode - postalCode - - - - - - - 500 - read - createTimestamp - createTimestamp - false - - - - - - - 510 - userSMIMECertificate - userSMIMECertificate - - - - - - - 520 - userCertificate - userCertificate - - - - - - - 530 - qn417:stringIgnoreCase - st - st - - - - - - - 540 - teletexTerminalIdentifier - teletexTerminalIdentifier - - - - - - - 550 - qn682:stringIgnoreCase - ou - ou - - - - - - - 560 - qn114:stringIgnoreCase - street - street - - - - - - - 570 - qn260:stringIgnoreCase - cn - cn - - - - - - - 580 - registeredAddress - registeredAddress - - - - - - - 590 - x121Address - x121Address - - - - - - - 600 - qn103:stringIgnoreCase - title - title - - - - - - - 610 - x500UniqueIdentifier - x500UniqueIdentifier - - - - - - - 620 - mobile - mobile - - - - - - - 100 - read - qn946:uuid - entryUUID - __UID__ - - - - - - - - - - ri:entryUUID - ri:dn - ri:dn - ri:dn - groupOfUniqueNames - - - - - - - 120 - read - createTimestamp - createTimestamp - false - - - - - - - 130 - uniqueMember - uniqueMember - - - - - - - 140 - memberOf - memberOf - false - - - - - - - 150 - qn47:stringIgnoreCase - ou - ou - - - - - - - 160 - qn800:stringIgnoreCase - cn - cn - - - - - - - 170 - qn573:stringIgnoreCase - o - o - - - - - - - 180 - qn389:distinguishedName - owner - owner - - - - - - - 190 - qn748:distinguishedName - seeAlso - seeAlso - - - - - - - 200 - qn447:stringIgnoreCase - description - description - - - - - - - 210 - qn897:stringIgnoreCase - businessCategory - businessCategory - - - - - - - 110 - qn327:distinguishedName - dn - __NAME__ - - - - - - - 100 - read - qn35:uuid - entryUUID - __UID__ - - - - - - - - - - ri:entryUUID - ri:dn - ri:dn - ri:dn - eduPerson - true - - - - - - - 120 - read - createTimestamp - createTimestamp - false - - - - - - - 130 - qn158:stringIgnoreCase - eduPersonScopedAffiliation - eduPersonScopedAffiliation - - - - - - - 140 - memberOf - memberOf - false - - - - - - - 150 - qn631:stringIgnoreCase - eduPersonPrimaryAffiliation - eduPersonPrimaryAffiliation - - - - - - - 160 - qn676:distinguishedName - eduPersonOrgDN - eduPersonOrgDN - - - - - - - 170 - qn444:distinguishedName - eduPersonOrgUnitDN - eduPersonOrgUnitDN - - - - - - - 180 - qn549:stringIgnoreCase - eduPersonAffiliation - eduPersonAffiliation - - - - - - - 190 - qn371:stringIgnoreCase - eduPersonPrincipalNamePrior - eduPersonPrincipalNamePrior - - - - - - - 200 - qn469:stringIgnoreCase - eduPersonTargetedID - eduPersonTargetedID - - - - - - - 210 - eduPersonEntitlement - eduPersonEntitlement - - - - - - - 220 - qn27:stringIgnoreCase - eduPersonAssurance - eduPersonAssurance - - - - - - - 230 - qn972:stringIgnoreCase - eduPersonNickname - eduPersonNickname - - - - - - - 240 - qn626:stringIgnoreCase - eduPersonOrcid - eduPersonOrcid - - - - - - - 250 - qn606:stringIgnoreCase - eduPersonPrincipalName - eduPersonPrincipalName - - - - - - - 260 - qn835:distinguishedName - eduPersonPrimaryOrgUnitDN - eduPersonPrimaryOrgUnitDN - - - - - - - 110 - qn348:distinguishedName - dn - __NAME__ - - - - - - - 270 - qn319:stringIgnoreCase - eduPersonUniqueId - eduPersonUniqueId - - - - - - - 100 - read - qn942:uuid - entryUUID - __UID__ - - - - - - - - - - ri:nsUniqueId - ri:dn - ri:dn - ri:dn - incwbPerson - true - - - - - - - 120 - nsAccountLock - nsAccountLock - false - - - - - - - 130 - read - createTimestamp - createTimestamp - false - - - - - - - 140 - qn940:distinguishedName - memberOf - memberOf - false - - - - - - - 150 - qn491:stringIgnoreCase - incwbPersonEmployeeID - incwbPersonEmployeeID - - - - - - - 160 - qn200:stringIgnoreCase - incwbPersonStudentID - incwbPersonStudentID - - - - - - - 170 - qn405:stringIgnoreCase - incwbPersonGuestID - incwbPersonGuestID - - - - - - - 110 - qn965:distinguishedName - dn - __NAME__ - - - - - - - 100 - read - nsUniqueId - __UID__ - - - - - - -